SSH Authenticate using a Smart Card Private Key

See more SSH Examples

Demonstrates using a private key stored on an HSM (smart card or token) for SSH public-key authentication. A JSON template locates the private and public key objects by class, key type, and label, and the returned handles are bound to an SshKey object.

const std = @import("std");
const chilkat = @import("chilkat");

pub fn main(init: std.process.Init) !void {
    const alloc = init.arena.allocator();

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // Demonstrates using a private key stored on an HSM (smart card or token) for SSH public-key
    // authentication.  Public-key authentication means the client uses the private key, while the
    // corresponding public key is installed on the server under the SSH account.
    //
    // Note: Chilkat's PKCS#11 implementation runs on Windows, Linux, macOS, and other supported
    // operating systems.

    const pkcs11 = try chilkat.Pkcs11.init();
    defer pkcs11.deinit();

    // Use the PKCS#11 driver (.dll, .so, or .dylib) for your particular HSM.
    pkcs11.setSharedLibPath("C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS11.dll");

    // The HSM PIN should come from a secure source rather than being hard-coded.
    const pin = "0000";

    // Normal user = 1
    const user_type = 1;

    pkcs11.quickSession(user_type, pin) catch {
        std.debug.print("{s}\n", .{try pkcs11.getLastErrorText(alloc)});
        return;
    };

    // Provide a template describing the PKCS#11 object to find: an RSA private key labeled
    // "MySshKey".  For how such a key is originally imported, see
    // PKCS11 Import SSH Key
    const json_template = try chilkat.JsonObject.init();
    defer json_template.deinit();
    json_template.updateString("class", "private_key") catch {};
    json_template.updateString("key_type", "rsa") catch {};
    json_template.updateString("label", "MySshKey") catch {};

    const priv_key_handle = pkcs11.findObject(json_template);
    if (priv_key_handle == 0) {
        std.debug.print("{s}\n", .{try pkcs11.getLastErrorText(alloc)});
        return;
    }

    // The handle is only valid for the duration of this PKCS#11 session.  To use the key in a
    // later session, find it again.
    std.debug.print("private key handle: {d}\n", .{priv_key_handle});

    // Find the corresponding public key by changing the class in the same template.
    json_template.updateString("class", "public_key") catch {};

    const pub_key_handle = pkcs11.findObject(json_template);
    if (pub_key_handle == 0) {
        std.debug.print("{s}\n", .{try pkcs11.getLastErrorText(alloc)});
        return;
    }

    std.debug.print("public key handle: {d}\n", .{pub_key_handle});

    // Create an empty SSH key object and tell it to use the PKCS#11 handles, indicating the key type.
    const ssh_key = try chilkat.SshKey.init();
    defer ssh_key.deinit();
    ssh_key.usePkcs11(pkcs11, priv_key_handle, pub_key_handle, "rsa") catch {
        std.debug.print("{s}\n", .{try ssh_key.getLastErrorText(alloc)});
        return;
    };

    const ssh = try chilkat.Ssh.init();
    defer ssh.deinit();

    const port = 22;
    ssh.connect("ssh.example.com", port) catch {
        std.debug.print("{s}\n", .{try ssh.getLastErrorText(alloc)});
        return;
    };

    // Authentication uses the existing PKCS#11 session.  The signing happens on the smart card --
    // the private key never leaves the device.
    ssh.authenticatePk("mySshLogin", ssh_key) catch {
        std.debug.print("{s}\n", .{try ssh.getLastErrorText(alloc)});
        return;
    };

    std.debug.print("Public-key authentication successful.\n", .{});

    // ... use the authenticated SSH session ...

    ssh.disconnect();

    pkcs11.logout() catch {};
    pkcs11.closeSession() catch {};
}